do not access a NULL pointer if an .Eo block lacks a tail;

found by jsg@ with afl, test case #16

1 files changed, 2 insertions, 3 deletions

diff --git a/mdoc_man.c b/mdoc_man.c
index ad3fc626..6bf832e5 100644
--- a/mdoc_man.c
+++ b/mdoc_man.c
@@ -1140,9 +1140,8 @@ pre_eo(DECL_ARGS)
 	    n->child->end != ENDBODY_NOT)
 		print_word("\\&");
 	else if (n->end != ENDBODY_NOT ? n->child != NULL :
-	    n->parent->head->child != NULL &&
-	    (n->parent->body->child != NULL ||
-	     n->parent->tail->child != NULL))
+	    n->parent->head->child != NULL && (n->child != NULL ||
+	    (n->parent->tail != NULL && n->parent->tail->child != NULL)))
 		outflags &= ~(MMAN_spc | MMAN_nl);
 	return(1);
 }